This is the accessible text file for GAO report number GAO-04-819R entitled 'Federal Emergency Management Agency: Lack of Controls and Key Information for Property Leave Assets Vulnerable to Loss or Misappropriation' which was released on July 15, 2004. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. July 15, 2004: The Honorable Michael Brown: Under Secretary for Emergency Preparedness & Response: Department of Homeland Security: Subject: Federal Emergency Management Agency: Lack of Controls and Key Information for Property Leave Assets Vulnerable to Loss or Misappropriation: Dear Mr. Under Secretary: As you know, prior to the transfer of the functions of the Federal Emergency Management Agency (FEMA), effective March 1, 2003, to the newly established Department of Homeland Security (DHS) within the Emergency Preparedness and Response Directorate (EP&R), FEMA was one of 24 Chief Financial Officers (CFO) Act agencies required to obtain annual financial statement audits.[Footnote 1] While DHS obtained a financial statement audit covering the period from March 1 through September 30, 2003, no financial statement audit was performed for FEMA activities for the 5 months prior to March 1, 2003. For fiscal year 2001, FEMA received a qualified audit opinion,[Footnote 2] which was due mostly to the auditor's inability to determine the accuracy of the amount reported for FEMA's equipment as well as other property issues. A major contributing factor was the lack of a property management system that adequately met FEMA's accounting needs or Joint Financial Management Improvement Program (JFMIP) requirements.[Footnote 3] Although FEMA received an unqualified opinion from its auditor in fiscal year 2002, the auditor reported six material weaknesses[Footnote 4] (one relating to its real and personal property system processes) and one reportable condition[Footnote 5] as well as significant year- end adjustments made to property accounts. Furthermore, the audit report noted that FEMA did not have policies and procedures in place to ensure the accuracy of data recorded in its personal property system, the Logistics and Information Management System (LIMS).[Footnote 6] Appendix I categorizes the weaknesses identified in FEMA's fiscal year 2002 audit report into nine general areas for which personal property controls need to be improved. The previously reported weaknesses as well as the very nature of FEMA's mission, disaster response, which entails the acquisition of new personal property, sometimes very quickly, raise the risk that property may have been acquired but not recorded in LIMS and not accounted for by FEMA in the interim 5 months before the agency functions were transferred to DHS. As such, given the past weaknesses and risks surrounding FEMA's property management, the objectives of our review were to determine (1) whether controls were in place to ensure that property acquired during the 5 months prior to FEMA transferring its functions to DHS was properly accounted for in LIMS and (2) whether FEMA has corrected previously reported property management weaknesses. To accomplish this work, we reviewed DHS's fiscal year 2003 Performance and Accountability Report, FEMA's fiscal year 2002 Performance and Accountability Report, reports by FEMA's Office of Inspector General (OIG) and Independent Public Accountants; performed walkthroughs of FEMA's acquisition and property management functions; and conducted interviews with relevant FEMA officials. We conducted our review from October 2003 to June 2004 in accordance with U.S. generally accepted government auditing standards. Results in Brief: FEMA continues to lack the controls and key information necessary to ensure that personal property is properly accounted for. Accordingly, we were unable to perform statistically based testing to conclude whether or not FEMA properly accounted for property acquired during the 5 months prior to transferring its functions to DHS. We attempted to manually trace property items from the acquisition system and related documentation to the property system. Because these systems do not share common data identifiers such as serial numbers, purchase order numbers, and the like, we were unable to complete our tests of individual items. Absent integrated or adequately interfaced systems with the key information necessary to track and account for property, accountable and sensitive property is highly vulnerable to loss or misappropriation. For example, FEMA's current property system, LIMS, does not interface with the acquisition or financial systems, and lacks a common data identifier, such as a serial number or invoice number, which would allow managers to track property from its acquisition to its receipt and entry in the property system through disposal. In addition, while the original acquisition date was recorded in LIMS, users of the system were able to change that date and frequently did so to reflect when items were transferred to other locations. FEMA has not corrected its reported weaknesses related to property and equipment. Its property system is still not JFMIP compliant. Although new data fields have been added to address compliance, the systems holding the data needed to populate those fields are not linked to LIMS and thus, do not routinely share information. While processes have been developed to transfer information for certain data fields manually, it has only been done for capitalized property, which makes up less than 1 percent of property items and roughly 20 percent or $73 million of the total property value in LIMS. FEMA's fiscal years 2001 and 2002 auditors reported material weaknesses related to FEMA's accounting for real and personal property, and we reiterated these weaknesses in our fiscal year 2003 Performance and Accountability Series.[Footnote 7] In addition, due to the reduced materiality of FEMA's real and personal property for financial statement audit purposes, these weaknesses were not included in the DHS's departmentwide audit report. Instead, the material weaknesses were included in an observations and recommendations comment provided to EP&R management. Due to decreased visibility of this issue and the seriousness of these problems given the nature of FEMA's operations, immediate corrective actions are warranted, so that these problems do not continue to grow or assets are not unnecessarily vulnerable to loss or misappropriation. This report makes six recommendations for actions, that, if fully implemented, should help FEMA and, consequently, DHS, better protect and account for its accountable and sensitive property. We obtained oral comments on a draft of this report from FEMA officials. They generally agreed with our conclusions and recommendations, but stated that some of the actions called for are already in place. As such, we have incorporated changes to emphasize that the appropriate officials not only receive the inventory certifications and documentation, but also review, follow-up on, and maintain them. FEMA officials also provided technical comments, which we incorporated as appropriate. Background: Effective March 1, 2003, the functions of FEMA were transferred to the Department of Homeland Security (DHS) within the Emergency Preparedness and Response (EP&R) Directorate. Prior to the transfer to DHS, FEMA was one of the 24 CFO Act[Footnote 8] agencies required to obtain annual financial statement audits. Now that it is a component of DHS, however, it is no longer subjected to annual, stand-alone audits. Further, because its real and personal property issues are much smaller in scope compared to other agencies and components transferred to DHS, such as the U.S. Coast Guard, FEMA's property is deemed less material for agencywide financial statement audit purposes, which results in less rigorous audit procedures and reviews than when it was a stand-alone agency. In fiscal years 2001 and 2002, when it was a stand-alone agency, the auditors reported that, among other things, FEMA did not have policies and procedures in place to ensure the accuracy of data recorded in its property system. This system, LIMS, was developed in-house for the special property tracking needs of FEMA's disaster-related recovery mission. Since its inception in 1993, the software has been updated several times, resulting in different versions. LIMS II, which was implemented in 2001, was the version in place at the time of FEMA's transfer to DHS. According to FEMA officials, it was run on obsolete system software, was not JFMIP compliant, and was limited in functionality. Further, each regional office had its own separate property database, which meant that there were 31 different databases. Thus, managers could not effectively oversee the overall property inventory. According to one FEMA official, the system contained a financial module, but use of the module was optional because the accounting system of record was Integrated Financial Management Information System (IFMIS), an entirely different system; thus, the module was rarely used. Over the course of fiscal year 2002, FEMA took steps to improve its property accounting. For example, FEMA hired contractors to conduct an agencywide inventory of capitalized personal property (property valued at $25,000 or greater) to ensure the correct reporting of equipment and related depreciation. Based on inventory results, FEMA recorded prior period adjustments that increased equipment acquisition costs and related depreciation by $74.5 million and $71.7 million, respectively. In addition, FEMA had planned to acquire a new JFMIP-compliant acquisition system in fiscal year 2002, but plans to do so were placed on hold because of an OMB moratorium on technology investments for agencies transferring activities to DHS. Shortly after the transfer to DHS (April 2003), FEMA installed its next iteration of the LIMS system, LIMS III, which was designed to be a more complete and accountable system. It is a Web-based system that combines all of the 31 formerly separate property databases into one system and includes enhancements, that, if properly implemented, would allow the system to be JFMIP compliant, according to FEMA officials. According to FEMA guidance prior to FEMA's transfer to DHS, capitalized property[Footnote 9] was defined as property over $25,000[Footnote 10] and accountable property was property costing over $5,000 or that FEMA determined to be "sensitive."[Footnote 11] FEMA guidance stated that these items are subject to special control and safeguards and will be accounted for and controlled through the use of a custody receipt,[Footnote 12] and the agency's property system (i.e., LIMS). These items include items such as pagers, cellular telephones, personal digital assistants, electronic test equipment, hand tools, and personal computers. Scope and Methodology: To determine what controls were in place to ensure that property acquired during the 5 months prior to FEMA's transfer to DHS was properly accounted for in LIMS, we obtained property data for fiscal year 2003 from FEMA's Property Management Unit, which was extracted from LIMS II, the version in place at the time of transfer. We attempted to verify the completeness and validity of the property information by comparing purchases recorded in the acquisition system for the 5-month period prior to its transfer to DHS, from October 1, 2002 to March 1, 2003 to entries in the LIMS system for the corresponding period. We determined that FEMA's acquisition and property systems do not share data and lacked key data we needed to perform our tests. Therefore, we were unable to validate that purchases made over the 5-month period were properly recorded into LIMS. As a result, we narrowed our scope of review to the adequacy of controls over property management at the time of FEMA's transfer and the status of previously reported property management weaknesses. To determine whether FEMA has corrected prior reported weaknesses, we performed walkthroughs of the purchasing, receiving, and property management processes; reviewed FEMA's policies and procedures, as well as GAO's Standards for Internal Control[Footnote 13] and JFMIP Guidance on Property Management Systems;[Footnote 14] reviewed reports by FEMA's OIG and Independent Public Accountants, as well as DHS's fiscal year 2003 Performance and Accountability Report and FEMA's corrective action plans; and interviewed FEMA staff. Our work was conducted from October 2003 to June 2004 in accordance with U.S. generally accepted government auditing standards. FEMA Did Not Have Controls in Place to Ensure Property Acquired Prior to Transfer Was Properly Accounted For: GAO's Standards for Internal Control in the Federal Government state that internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. Also, internal control should generally be designed to ensure that ongoing monitoring such as comparisons, reconciliations, and other actions, occurs in the course of normal operations, to ensure that known weaknesses are resolved. FEMA lacks the controls and key information necessary to ensure property is properly accounted for in LIMS. Due to this lack of key information, we could not determine whether purchases made during the 5 months prior to its transfer were accurately recorded. We attempted to manually trace property items from the acquisition system and related documentation to the property system, but because these systems do not share common data identifiers such as serial numbers or purchase order numbers, we were unable to conduct valid tests. These weaknesses would summarily preclude FEMA itself from conducting any conclusive internal assessments and therefore, there is a risk that property may have been purchased but not properly recorded in LIMS. FEMA did not perform fundamental internal control activities and track key information necessary to document and account for property to ensure that purchases made during the 5 months prior to its transfer to DHS were properly or accurately recorded. Timely, accurate, and useful financial information is essential for making day-to-day operating decisions. Maintaining the government's operations more efficiently, effectively, and economically; meeting the goals of federal financial management reform legislation; supporting results-oriented management approaches; and ensuring accountability on an ongoing basis are also critical. According to the Joint Financial Management Improvement Program Property System Requirements Guide,[Footnote 15] property management systems must be able to track an item from acquisition through changes in location to disposal. The guide also states that the property system must forward physical receipt information including quantity and date of physical receipt to the acquisition system and core financial system. Thus, the property system should be capable of interfacing with other financial or mixed systems. However, we found that despite FEMA's efforts to improve its current property system, LIMS III, it still does not interface or share common data identifiers with any of the other systems, including the financial and acquisition systems. Previously Reported Property Management Weaknesses Have Not Been Corrected: We found that FEMA has not corrected material weaknesses related to its accounting for real and personal property that its auditor reported in fiscal year 2001 and again in fiscal year 2002; and which we reiterated in our fiscal year 2003 Performance and Accountability Series.[Footnote 16] Such weaknesses include noncompliance with JFMIP requirements, key systems lacking interfaces with each other, and not performing required annual inventories of accountable and sensitive property. Among the lingering issues carried over to DHS is that a number of factors have combined to make FEMA's property control weaknesses less visible from a DHS-wide perspective, but no less severe from the perspective of FEMA operations. Therefore, EP&R must recognize the seriousness of these issues as it impinges on FEMA operations and develop a course of action to resolve or mitigate the issues. In fiscal year 2002, the auditor reported that FEMA did not have adequate accounting systems and processes to ensure that all property, plant, and equipment were properly recorded, accurately depreciated, and tracked in accordance with its policies and applicable federal accounting standards. Specifically, the independent auditor reported that FEMA's personal property management system, known as LIMS, was not interfaced with its financial system, IFMIS, thus requiring numerous manual workarounds to ensure accounting information is accurately recorded. LIMS, used primarily to track the location and availability of equipment for its mission of disaster response, cannot perform accounting functions required by JFMIP. To address this, FEMA officials stated that data fields were added to LIMS in its most recent upgrade (May 2003) so that the system would meet JFMIP requirements. Having the capability to handle accounting information did not entirely resolve this problem, however. During our review, we found that these data fields were not automatically populated because the system is not linked electronically to, and, thus, not able to routinely share information with, the acquisition systems or IFMIS. While processes have been developed to transfer some data manually, it is limited to the data for capitalized property, which makes up less than 1 percent of property items and 20 percent or $73 million of the total property value in LIMS as shown in table 1. Thus, data for FEMA's accountable and sensitive property, which constitute the majority of the property and which, by their very nature are more susceptible to theft or pilferage are excluded from this process. Table 1: Property Totals in LIMS as of May 31, 2004. [See PDF for image] Property with an initial acquisition cost of more than $50,000 with an expected service life of 2 years or more. Property with an initial acquisition cost of more than $5,000 or property, which by their nature are vulnerable to theft or pilferage, for which controls and official property records are maintained and physical inventories are conducted. Property of a low dollar value, which loses its identity when consumed or when incorporated into another item, or with an expected service life of less than 1 year. [End of table] Another weakness reported in both FEMA's fiscal years 2001 and 2002 audit reports is that property acquisition dates were changed when items were transferred within FEMA and among disaster sites to reflect the transfer dates. Thus, the original purpose of the data field, to show when the item was purchased, has been altered to cater to the needs of FEMA's mission. A related problem is that LIMS does not contain data fields to record purchase order or invoice numbers that can be used to link property items to accounting-related and acquisition records. The problems outlined above contribute to weak linkages for substantiating the acquisition date and valuation of property, which is paramount not only for computing depreciation, but for overall accountability. These issues can contribute to financial statement implications, as was the case in fiscal year 2002 when FEMA had to record a prior period adjustment as of September 30, 2001, to increase equipment acquisition cost and accumulated depreciation by $74.5 million and $71.7 million, respectively. In general, property items should track to their supporting procurement information, and accounting records should correlate to any FEMA property located at either FEMA sites or in the custody of others. Although FEMA officials had hoped to acquire a new property management system, plans to do so were deferred in 2002 because OMB issued a systems purchase moratorium for agency functional areas being transferred to DHS. To help address its issues regarding accountability over property, FEMA hired contractors to perform an inventory of its capitalized property in 2002. The contractor found 11 specific areas that they believed "warranted further attention by FEMA to ensure the completeness and accuracy of the agency's capital property." One of the areas noted was the need for FEMA to complete a wall-to-wall inventory of all property. The contractors reported that a significant number of items were identified during the inventories that were not in LIMS. According to the report, it "seems that when headquarters requests an inventory of capitalized equipment, typically the field simply 'prints' what is in LIMS and then validates its on-site or deployed location.": Such an approach does not account for or help identify noncapitalized property such as accountable and personal property that is not recorded in LIMS. FEMA's weak inventory practices were reported on again in FEMA's fiscal year 2002 audit report, as the auditor noted that some Accountable Property Officers (APO) did not check property on-site against LIMS records (i.e., a floor-to-book test) and that some locations did not provide a current or complete certified inventory[Footnote 17] as part of the baseline inventory effort. Such inventory practices cast doubt as to the completeness and reliability of FEMA's property information. Despite agency guidance requiring annual inventories for capital, accountable, and sensitive property, as well as its status as an action item from its fiscal year 2002 audit, inventories for accountable or sensitive property were not completed by all site locations in fiscal year 2003. One official told us this could be because FEMA wanted to wait until bar-coding capability was fully functional in LIMS, which would help provide for better and more accurate tracking of inventory, but that capability was never fully implemented. Also, since each region is responsible for doing its own inventory of capitalized and accountable property and sending a memo to FEMA headquarters certifying that an inventory was completed; and because the organizational structure for FEMA's property management section has changed significantly since the fiscal year 2002 financial statement audit, according to FEMA officials, there may have been confusion among field staff as to the person responsible for receiving the memos. Because FEMA is just a piece of a much larger DHS and no longer receives a stand-alone audit, it receives much less audit attention and problems that are identified are not necessarily material when viewed DHS-wide. For example, FEMA control weaknesses found during the 2002 audit were not included in DHS's departmentwide audit report, but instead were included in an observations and recommendations comment provided to EP&R. In addition, FEMA's capitalization threshold was raised from $25,000 to $50,000 upon transferring its functions to DHS, which results in less audit coverage for property on an agencywide basis. This elevated capitalization level could result in an unintentional lack of accountability over property that was formerly required to be tracked and inventoried for financial statement purposes. A prime illustration of this is the previously mentioned manual transfer of the acquisition dates, which is currently limited to capitalized property, thus excluding accountable and sensitive items. Further, due to its relatively decreased prominence at DHS from an audit perspective, FEMA will not receive the visibility and oversight afforded the annual financial statement audits, as it had before transferring its functions to DHS. Thus, it is incumbent upon FEMA to effectively account for, track, and inventory all of its property to ensure that it does not lose what it has gained as a result of its property management improvements. Conclusion: Federal agency property management systems are critical for establishing financial accounting and maintaining accountability over property. Such systems assist property managers in managing their property in accordance with missions and roles established by Congress. FEMA's lack of adequate systems and processes to ensure that all property, plant, and equipment are properly recorded, accurately depreciated, and tracked not only creates an environment where property is highly susceptible to loss or misappropriation with little risk of detection, but also affects the accuracy of the property and financial information used by managers to make key agency decisions. Even with the improvements made thus far, the overall lack of transparency in FEMA's acquisition and property management processes could result in highly sensitive and accountable property not being entered into the property system and thus not accounted for. If this situation continues over time, it could affect FEMA's and ultimately DHS's ability to effectively manage its limited resources and assets. This is extremely important for an organization such as FEMA whose mission requires it and its property to be highly versatile and mobile on a moment's notice. Therefore, it is important that FEMA management establish adequate financial management systems and internal controls over these highly vulnerable assets. Recommendations for Executive Action: In order to establish adequate internal control over property management and reduce vulnerability to fraud, waste, and abuse, we recommend that the Secretary of the Department of Homeland Security direct the Under Secretary for Emergency Preparedness and Response or Under Secretary for Management to take the following six actions: * Require FEMA's property system to be linked to acquisition and financial systems so certain key information can be available for effective property management. * Require floor-to-book inventories in addition to current inventory processes. * Ensure, through the use of a tracking system or official document, that all FEMA locations complete a comprehensive inventory of all property, including accountable and sensitive items, on an annual basis. * Reiterate and clarify property management procedures for certifying and documenting inventories. * Ensure that documentation of the inventories is collected and maintained in a central location at headquarters for management review. * Identify employees responsible for receiving, reviewing, following up on, and maintaining inventory certifications and results from FEMA's field and disaster locations. Agency Comments on Our Evaluation: We obtained oral comments on a draft of this report from FEMA officials. They generally agreed with our conclusions and recommendations. However, they stated that some of the actions called for are already in place. As a result, we have incorporated changes to emphasize that the appropriate officials not only receive the inventory certifications and documentation, but also review, follow-up on, and maintain them. Further, we would like to recognize the fact that some of these recommendations, namely those dealing with the need for an integrated property management system and the issuance of policy are now under the direction of DHS and will likely take time to be implemented at the departmental level. FEMA officials also provided technical comments, which we incorporated as appropriate. Once published, we plan to send copies of this letter to the Chairs and Ranking Members of the Senate Governmental Affairs Committee, the House Government Reform Committee, and other interested congressional committees, as well as the Director of the Office of Management and Budget, and other interested parties within DHS. We will provide copies to others upon request. This letter will also be available on GAO's Web site at http://www.gao.gov. Please contact me at (202) 512-6906 or by e-mail at williamsM1@gao.gov or Casey Keplinger, Assistant Director, at (202) 512-9323 or by e-mail at firstname.lastname@example.org. Major contributors to this letter were Cary Chappell, Lisa Crye, and Saurav Prasad. Sincerely yours, Signed by: McCoy Williams: Director, Financial Management and Assurance: Appendix I: In fiscal year 2002, FEMA's independent auditor identified several weaknesses, which we have categorized into nine general areas for which personal property controls need to be improved (see table). Additionally, FEMA's corrective actions as of May 19, 2004 have been included. Table 2: Reportable Weaknesses from FEMA's Fiscal Year 2002 Performance and Accountability Report: [See PDF for image] Source: FEMA Annual Performance & Accountability Report Fiscal Year 2002. [End of table] (195021): FOOTNOTES  See 31 U.S.C. §§ 901(b), 3515(a), 3521(e) (2000).  A qualified opinion states that except for the effects of the matter to which the qualification relates, the financial statements present fairly, in all material respects, the assets, liabilities, net position, net costs, changes in net position, budgetary resources, reconciliation of net costs with budgetary obligations, and custodial activities (if applicable) in conformity with Generally Accepted Accounting Principles.  The Joint Financial Management Improvement Program (JFMIP) is a joint and cooperative undertaking of the U.S. Department of the Treasury, the General Accounting Office, the Office of Management and Budget, and the Office of Personnel Management working with each other and other agencies to improve financial management practices in government.  A material weakness is a condition that precludes the entity's internal control from providing reasonable assurance that misstatements, losses, or noncompliance material in relation to the financial statements or to the stewardship information would be prevented or detected on a timely basis.  Reportable conditions are matters coming to an auditor's attention that, in their judgment, should be communicated because these represent significant deficiencies in the design or operation of internal control that could adversely affect the federal government's ability to meet the internal control objectives.  Federal Emergency Management Agency, Annual Performance and Accountability Report Fiscal Year 2002 (Washington, D.C.: Jan. 24, 2003).  U.S. General Accounting Office, Major Management Challenges and Program Risks: Federal Emergency Management Agency, GAO-03-113 (Washington, D.C.: Jan. 24, 2003).  See 31 U.S.C. §§ 901(b), 3515(a), 3521(e) (2000).  Capitalized property refers to nonexpendable property (excluding stewardship property, plant, and equipment) with a useful life of 2 years or more and an acquisition cost above a predetermined dollar value threshold.  This threshold was increased to $50,000 by DHS.  FEMA defines sensitive property as accountable property (regardless of original acquisition cost), that is highly susceptible to misuse, loss, or theft, and will be accounted for and controlled through the use of LIMS. An annual physical inventory and a complete audit trail from receipt to final disposition are required for sensitive equipment.  Custody receipts are used when property is issued or delivered to a recipient, who is to sign for the items, retain a copy, and return the signed original to the issuer to file.  U.S. General Accounting Office, Internal Control: Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).  Joint Financial Management Improvement Program, Federal Financial Management System Requirements: Property Management Systems Requirements, JFMIP-SR-00-4 (Washington, D.C.: October 2000).  JFMIP-SR-00-4.  GAO-03-113.  According to FEMA's Personal Property Management guidance, Property Management Officers (PMO) and APOs must certify that an annual inventory was accomplished as prescribed.